Halfway down the hall for coffee, Claude Code pauses on a single git worktree or docker compose confirmation — idling for twenty minutes until you walk back. LinkShell puts the exact command on your Apple Watch and iPhone Lock Screen so you tap Allow in one second without turning off permission checks.
iOS 17+ Lock-Screen buttons · watchOS 10+ companion & standalone Wi-Fi/LTE · E2E XChaCha20-Poly1305
pnpm db:migrate:test && pnpm test
Try tapping Allow — your computer receives an authenticated, E2E-sealed RPC answer.
Forwarding shell commands through unencrypted Slack/Telegram bots leaks proprietary repo context and exposes an unauthenticated trigger. LinkShell keeps every permission card end-to-end encrypted.
While a turn runs, Dynamic Island tracks active tools and progress. The moment Claude Code or Codex hits an approval gate:
LinkShellDeny and Allow run directly inside the Lock-Screen Live Activity via LiveActivityIntent.watchOS suspends long-lived third-party WebSockets aggressively, so LinkShell uses a dual-path architecture:
WatchConnectivity with near-zero battery impact./v2/poll: On Wi-Fi or cellular away from your iPhone, the Watch exchanges ephemeral X25519 keys and seals answers with XChaCha20-Poly1305. Plus 44pt buttons and quick voice replies.You should not have to disable every guardrail just so an agent can finish a refactor while you make dinner.
| Dimension | LinkShell Watch + Lock Screen | --dangerously-skip-permissions |
Telegram / Discord Hook Bots | Mobile SSH App |
|---|---|---|---|---|
| Time to approve away from desk | ~1 second — glance at wrist or Lock Screen, tap Allow | 0 seconds (approves destructive mistakes too) | 5–15 seconds (unlock phone, open chat app, tap callback) | 20–40 seconds (unlock, reconnect SSH, attach tmux, press key) |
| Blast-radius protection | Full guardrails stay active — review exact command & cwd before execution | None on host filesystem, git history, or local secrets | Partial — custom hook scripts often miss MCP or sub-agent tools | Full, if session stays attached |
| End-to-end encryption | Yes (Ed25519 + X25519 + XChaCha20-Poly1305) on iPhone & Watch | Local only | Plaintext commands stored on third-party chat servers | SSH transport (requires VPN or exposed port) |
| Steer or inspect diffs mid-turn | Short reply from Watch; full file diffs, queue & 120fps screen on iPhone | No remote visibility when away | Text snippets only; cannot browse diffs or take over terminal | Raw terminal scrollback only |
$ npm i -g linkshell-cli
$ linkshell setup
# Attach Claude Code or Codex to LinkShell Host
$ linkshell claude
$ linkshell codexMIT open-source relay in one Docker command
nickname4th/linkshell-gateway¥99/yr Alipay · or $3.19/mo (¥9.9/mo) monthly
No. On iOS 17 or later, LinkShell's Live Activity on the iPhone Lock Screen renders interactive Deny and Allow buttons powered by LiveActivityIntent. One tap answers the host daemon immediately while your phone stays locked.
Yes. When your Apple Watch (watchOS 10+) is near your iPhone, it relays over WatchConnectivity. When your iPhone stays on your desk and your Watch is on Wi-Fi or LTE, the Watch polls /v2/poll directly over HTTPS and decrypts payloads locally using X25519 + XChaCha20-Poly1305 — the gateway still never sees plaintext.
Skipping all permission checks gives an agent unrestricted shell, git push, rm, and credential access the moment a prompt misunderstands a path or hits untrusted repo content. LinkShell lets safe read/edit steps run fast while surfacing destructive bash, network, or deploy actions on your wrist in under a second.
Yes. Beyond Allow, Allow for Session, and Deny (all sized to 44pt+ tap targets), the Watch app lets you dictate or scribble a short steering reply straight into the active session.
Claude Code, OpenAI Codex, Gemini CLI, Cursor CLI, GitHub Copilot CLI, OpenCode, Qwen Code, Kimi CLI, Goose, and ACP-compatible agents running under LinkShell Host on macOS, Windows, WSL2, or Linux.
Install LinkShell on your iPhone (the Apple Watch app installs right alongside it) and attach your next linkshell claude or linkshell codex session.